CashCrate Breach Exposes 6.8 M Accounts with Plain‑Text Passwords
What Happened — In November 2016, the cash‑for‑surveys platform CashCrate suffered a data breach that was publicly disclosed in June 2017. Attackers accessed a database containing 6,844,490 user records, including names, physical addresses, email addresses, and passwords stored in clear text (older accounts) or weak MD5 hashes (newer accounts).
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential‑storage controls, a core control‑area that continuous‑monitoring programs are built to verify and evidence.
- Highlights the need for defensible audit trails around password‑policy enforcement, hashing standards, and encryption of sensitive personal data.
- Directly tests the “credential protection” objective that maps to multiple frameworks (e.g., NIST CSF 2.0, ISO 27001) through a single control.
Who Is Affected – Consumer‑focused SaaS platforms, online survey or rewards sites, and any service that stores user‑generated credentials.
Recommended Actions
- Review and upgrade password‑storage mechanisms to salted, computationally‑hard hash functions (e.g., Argon2, bcrypt).
- Implement continuous credential‑management monitoring to detect weak or plain‑text storage.
- Document the remediation steps and retain evidence for audit readiness. Source: Have I Been Pwned – CashCrate breach
Technical Notes – The breach exposed data via a compromised database; passwords were stored in clear text for legacy accounts and as unsalted MD5 hashes for newer accounts, providing trivial offline cracking capability. No specific CVE is associated. Source: same as above